Ensure reproducible CI

[PgBiel]

Would be nice to avoid the problem found at #197 due to CI not being reproducible (it always pulls the latest CSL styles etc.). An alternative would be to pin the commits for CSL styles, bumping them manually every once in a while, and add a separate workflow which checks for compatibility with the latest commit, and runs weekly automatically (also better than checking through CI as a weekly workflow would run regardless of repository activity).